{"schema_version":"1.7.5","id":"GHSA-qppj-fm5r-hxr3","published":"2023-10-10T21:28:24Z","modified":"2026-05-20T08:11:02.423329230Z","aliases":["BIT-apisix-2023-44487","BIT-aspnet-core-2023-44487","BIT-contour-2023-44487","BIT-dotnet-2023-44487","BIT-dotnet-sdk-2023-44487","BIT-envoy-2023-44487","BIT-golang-2023-44487","BIT-jenkins-2023-44487","BIT-kong-2023-44487","BIT-nginx-2023-44487","BIT-nginx-gateway-2023-44487","BIT-node-2023-44487","BIT-node-min-2023-44487","BIT-solr-2023-44487","BIT-tomcat-2023-44487","BIT-varnish-2023-44487","CVE-2023-44487"],"related":["CGA-pcp8-xw84-x72j","CVE-2023-44487"],"summary":"HTTP/2 Stream Cancellation Attack","details":"## HTTP/2 Rapid reset attack\nThe HTTP/2 protocol allows clients to indicate to the server that a previous stream should be canceled by sending a RST_STREAM frame. The protocol does not require the client and server to coordinate the cancellation in any way, the client may do it unilaterally. The client may also assume that the cancellation will take effect immediately when the server receives the RST_STREAM frame, before any other data from that TCP connection is processed.\n\nAbuse of this feature is called a Rapid Reset attack because it relies on the ability for an endpoint to send a RST_STREAM frame immediately after sending a request frame, which makes the other endpoint start working and then rapidly resets the request. The request is canceled, but leaves the HTTP/2 connection open. \n\nThe HTTP/2 Rapid Reset attack built on this capability is simple: The client opens a large number of streams at once as in the standard HTTP/2 attack, but rather than waiting for a response to each request stream from the server or proxy, the client cancels each request immediately.\n\nThe ability to reset streams immediately allows each connection to have an indefinite number of requests in flight. By explicitly canceling the requests, the attacker never exceeds the limit on the number of concurrent open streams. The number of in-flight requests is no longer dependent on the round-trip time (RTT), but only on the available network bandwidth.\n\nIn a typical HTTP/2 server implementation, the server will still have to do significant amounts of work for canceled requests, such as allocating new stream data structures, parsing the query and doing header decompression, and mapping the URL to a resource. For reverse proxy implementations, the request may be proxied to the backend server before the RST_STREAM frame is processed. The client on the other hand paid almost no costs for sending the requests. This creates an exploitable cost asymmetry between the server and the client.\n\nMultiple software artifacts implementing HTTP/2 are affected. This advisory was originally ingested from the `swift-nio-http2` repo advisory and their original conent follows.\n\n## swift-nio-http2 specific advisory\nswift-nio-http2 is vulnerable to a denial-of-service vulnerability in which a malicious client can create and then reset a large number of HTTP/2 streams in a short period of time. This causes swift-nio-http2 to commit to a large amount of expensive work which it then throws away, including creating entirely new `Channel`s to serve the traffic. This can easily overwhelm an `EventLoop` and prevent it from making forward progress.\n\nswift-nio-http2 1.28 contains a remediation for this issue that applies reset counter using a sliding window. This constrains the number of stream resets that may occur in a given window of time. Clients violating this limit will have their connections torn down. This allows clients to continue to cancel streams for legitimate reasons, while constraining malicious actors.","affected":[{"package":{"name":"github.com/apple/swift-nio-http2","ecosystem":"SwiftURL","purl":"pkg:swift/github.com/apple/swift-nio-http2"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.28.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"golang.org/x/net","ecosystem":"Go","purl":"pkg:golang/golang.org/x/net"},"ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.17.0"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.apache.tomcat:tomcat-coyote","ecosystem":"Maven","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.0-M12"}]}],"versions":["11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.apache.tomcat:tomcat-coyote","ecosystem":"Maven","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.1.14"}]}],"versions":["10.0.0","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.16","10.0.17","10.0.18","10.0.2","10.0.20","10.0.21","10.0.22","10.0.23","10.0.26","10.0.27","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.2","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.apache.tomcat:tomcat-coyote","ecosystem":"Maven","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.81"}]}],"versions":["9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.apache.tomcat:tomcat-coyote","ecosystem":"Maven","purl":"pkg:maven/org.apache.tomcat/tomcat-coyote"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.94"}]}],"versions":["8.5.0","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","ecosystem":"Maven","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-M1"},{"fixed":"11.0.0-M12"}]}],"versions":["11.0.0-M1","11.0.0-M10","11.0.0-M11","11.0.0-M3","11.0.0-M4","11.0.0-M5","11.0.0-M6","11.0.0-M7","11.0.0-M9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","ecosystem":"Maven","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.1.14"}]}],"versions":["10.0.0","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.16","10.0.17","10.0.18","10.0.2","10.0.20","10.0.21","10.0.22","10.0.23","10.0.26","10.0.27","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.1.0","10.1.0-M1","10.1.0-M10","10.1.0-M11","10.1.0-M12","10.1.0-M14","10.1.0-M15","10.1.0-M16","10.1.0-M17","10.1.0-M2","10.1.0-M4","10.1.0-M5","10.1.0-M6","10.1.0-M7","10.1.0-M8","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.2","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","ecosystem":"Maven","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.0.0"},{"fixed":"9.0.81"}]}],"versions":["9.0.1","9.0.10","9.0.11","9.0.12","9.0.13","9.0.14","9.0.16","9.0.17","9.0.19","9.0.2","9.0.20","9.0.21","9.0.22","9.0.24","9.0.26","9.0.27","9.0.29","9.0.30","9.0.31","9.0.33","9.0.34","9.0.35","9.0.36","9.0.37","9.0.38","9.0.39","9.0.4","9.0.40","9.0.41","9.0.43","9.0.44","9.0.45","9.0.46","9.0.48","9.0.5","9.0.50","9.0.52","9.0.53","9.0.54","9.0.55","9.0.56","9.0.58","9.0.59","9.0.6","9.0.60","9.0.62","9.0.63","9.0.64","9.0.65","9.0.67","9.0.68","9.0.69","9.0.7","9.0.70","9.0.71","9.0.72","9.0.73","9.0.74","9.0.75","9.0.76","9.0.78","9.0.79","9.0.8","9.0.80"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.apache.tomcat.embed:tomcat-embed-core","ecosystem":"Maven","purl":"pkg:maven/org.apache.tomcat.embed/tomcat-embed-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"8.5.0"},{"fixed":"8.5.94"}]}],"versions":["8.5.0","8.5.11","8.5.12","8.5.13","8.5.14","8.5.15","8.5.16","8.5.19","8.5.2","8.5.20","8.5.21","8.5.23","8.5.24","8.5.27","8.5.28","8.5.29","8.5.3","8.5.30","8.5.31","8.5.32","8.5.33","8.5.34","8.5.35","8.5.37","8.5.38","8.5.39","8.5.4","8.5.40","8.5.41","8.5.42","8.5.43","8.5.45","8.5.46","8.5.47","8.5.49","8.5.5","8.5.50","8.5.51","8.5.53","8.5.54","8.5.55","8.5.56","8.5.57","8.5.58","8.5.59","8.5.6","8.5.60","8.5.61","8.5.63","8.5.64","8.5.65","8.5.66","8.5.68","8.5.69","8.5.70","8.5.71","8.5.72","8.5.73","8.5.75","8.5.76","8.5.77","8.5.78","8.5.79","8.5.8","8.5.81","8.5.82","8.5.83","8.5.84","8.5.85","8.5.86","8.5.87","8.5.88","8.5.89","8.5.9","8.5.90","8.5.91","8.5.92","8.5.93"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.eclipse.jetty.http2:http2-common","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty.http2/http2-common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3.0"},{"fixed":"9.4.53"}]}],"versions":["9.3.0.v20150612","9.3.1.v20150714","9.3.10.M0","9.3.10.v20160621","9.3.11.M0","9.3.11.v20160721","9.3.12.v20160915","9.3.13.M0","9.3.13.v20161014","9.3.14.v20161028","9.3.15.v20161220","9.3.16.v20170120","9.3.17.RC0","9.3.17.v20170317","9.3.18.v20170406","9.3.19.v20170502","9.3.2.v20150730","9.3.20.v20170531","9.3.21.M0","9.3.21.RC0","9.3.21.v20170918","9.3.22.v20171030","9.3.23.v20180228","9.3.24.v20180605","9.3.25.v20180904","9.3.26.v20190403","9.3.27.v20190418","9.3.28.v20191105","9.3.29.v20201019","9.3.3.v20150827","9.3.30.v20211001","9.3.4.RC0","9.3.4.RC1","9.3.4.v20151007","9.3.5.v20151012","9.3.6.v20151106","9.3.7.RC0","9.3.7.RC1","9.3.7.v20160115","9.3.8.RC0","9.3.8.v20160314","9.3.9.M0","9.3.9.M1","9.3.9.v20160517","9.4.0.M0","9.4.0.M1","9.4.0.RC0","9.4.0.RC1","9.4.0.RC2","9.4.0.RC3","9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.5.v20170502","9.4.5.v20180619","9.4.50.v20221201","9.4.51.v20230217","9.4.52.v20230823","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.eclipse.jetty.http2:http2-common","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty.http2/http2-common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.17"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.eclipse.jetty.http2:http2-common","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty.http2/http2-common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.17"}]}],"versions":["11.0.0","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.2","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.eclipse.jetty.http2:http2-server","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty.http2/http2-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3.0"},{"fixed":"9.4.53"}]}],"versions":["9.3.0.v20150612","9.3.1.v20150714","9.3.10.M0","9.3.10.v20160621","9.3.11.M0","9.3.11.v20160721","9.3.12.v20160915","9.3.13.M0","9.3.13.v20161014","9.3.14.v20161028","9.3.15.v20161220","9.3.16.v20170120","9.3.17.RC0","9.3.17.v20170317","9.3.18.v20170406","9.3.19.v20170502","9.3.2.v20150730","9.3.20.v20170531","9.3.21.M0","9.3.21.RC0","9.3.21.v20170918","9.3.22.v20171030","9.3.23.v20180228","9.3.24.v20180605","9.3.25.v20180904","9.3.26.v20190403","9.3.27.v20190418","9.3.28.v20191105","9.3.29.v20201019","9.3.3.v20150827","9.3.30.v20211001","9.3.4.RC0","9.3.4.RC1","9.3.4.v20151007","9.3.5.v20151012","9.3.6.v20151106","9.3.7.RC0","9.3.7.RC1","9.3.7.v20160115","9.3.8.RC0","9.3.8.v20160314","9.3.9.M0","9.3.9.M1","9.3.9.v20160517","9.4.0.M0","9.4.0.M1","9.4.0.RC0","9.4.0.RC1","9.4.0.RC2","9.4.0.RC3","9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.5.v20170502","9.4.5.v20180619","9.4.50.v20221201","9.4.51.v20230217","9.4.52.v20230823","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.eclipse.jetty.http2:http2-server","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty.http2/http2-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.17"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.eclipse.jetty.http2:http2-server","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty.http2/http2-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.17"}]}],"versions":["11.0.0","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.2","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.eclipse.jetty.http2:jetty-http2-common","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty.http2/jetty-http2-common"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.2"}]}],"versions":["12.0.0","12.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"org.eclipse.jetty.http2:jetty-http2-server","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty.http2/jetty-http2-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.2"}]}],"versions":["12.0.0","12.0.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"com.typesafe.akka:akka-http-core","ecosystem":"Maven","purl":"pkg:maven/com.typesafe.akka/akka-http-core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.3"}]}],"versions":["3.0.0-RC1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"com.typesafe.akka:akka-http-core_2.13","ecosystem":"Maven","purl":"pkg:maven/com.typesafe.akka/akka-http-core_2.13"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.3"}]}],"versions":["10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.8","10.1.9","10.2.0","10.2.0-M1","10.2.0-RC1","10.2.0-RC2","10.2.1","10.2.10","10.2.2","10.2.3","10.2.4","10.2.5","10.2.5-M1","10.2.5-M2","10.2.6","10.2.7","10.2.8","10.2.9","10.4.0","10.4.0-M1","10.4.0-M2","10.5.0","10.5.0-M1","10.5.1","10.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"com.typesafe.akka:akka-http-core_2.12","ecosystem":"Maven","purl":"pkg:maven/com.typesafe.akka/akka-http-core_2.12"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"10.5.3"}]}],"versions":["10.0.0","10.0.0-RC2","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.6+7-e2ba6752","10.0.7","10.0.8","10.0.9","10.1.0","10.1.0-RC1","10.1.0-RC2","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.2","10.1.3","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9","10.2.0","10.2.0-M1","10.2.0-RC1","10.2.0-RC2","10.2.1","10.2.10","10.2.2","10.2.3","10.2.4","10.2.5","10.2.5-M1","10.2.5-M2","10.2.6","10.2.7","10.2.8","10.2.9","10.4.0","10.4.0-M1","10.4.0-M2","10.5.0","10.5.0-M1","10.5.1","10.5.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}},{"package":{"name":"com.typesafe.akka:akka-http-core_2.11","ecosystem":"Maven","purl":"pkg:maven/com.typesafe.akka/akka-http-core_2.11"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"10.1.15"}]}],"versions":["10.0.0","10.0.0-RC2","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.6+7-e2ba6752","10.0.7","10.0.8","10.0.9","10.1.0","10.1.0-RC1","10.1.0-RC2","10.1.1","10.1.10","10.1.11","10.1.12","10.1.13","10.1.14","10.1.15","10.1.2","10.1.3","10.1.4","10.1.5","10.1.6","10.1.7","10.1.8","10.1.9","2.4-ARTERY-M1","2.4-ARTERY-M2","2.4-ARTERY-M3","2.4-ARTERY-M4","2.4.10","2.4.11","2.4.11.1","2.4.11.2","2.4.2","2.4.2-RC1","2.4.2-RC2","2.4.2-RC3","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9","2.4.9-RC1","2.4.9-RC2","3.0.0-RC1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2023/10/GHSA-qppj-fm5r-hxr3/GHSA-qppj-fm5r-hxr3.json"}}],"references":[{"type":"WEB","url":"https://github.com/apple/swift-nio-http2/security/advisories/GHSA-qppj-fm5r-hxr3"},{"type":"WEB","url":"https://github.com/h2o/h2o/security/advisories/GHSA-2m7v-gc89-fjqf"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2023-44487"},{"type":"WEB","url":"https://github.com/alibaba/tengine/issues/1872"},{"type":"WEB","url":"https://github.com/apache/apisix/issues/10320"},{"type":"WEB","url":"https://github.com/akka/akka-http/issues/4323"},{"type":"WEB","url":"https://github.com/varnishcache/varnish-cache/issues/3996"},{"type":"WEB","url":"https://github.com/tempesta-tech/tempesta/issues/1986"},{"type":"WEB","url":"https://github.com/Azure/AKS/issues/3947"},{"type":"WEB","url":"https://github.com/opensearch-project/data-prepper/issues/3474"},{"type":"WEB","url":"https://github.com/caddyserver/caddy/issues/5877"},{"type":"WEB","url":"https://github.com/openresty/openresty/issues/930"},{"type":"WEB","url":"https://github.com/dotnet/announcements/issues/277"},{"type":"WEB","url":"https://github.com/eclipse/jetty.project/issues/10679"},{"type":"WEB","url":"https://github.com/etcd-io/etcd/issues/16740"},{"type":"WEB","url":"https://github.com/golang/go/issues/63417"},{"type":"WEB","url":"https://github.com/ninenines/cowboy/issues/1615"},{"type":"WEB","url":"https://github.com/haproxy/haproxy/issues/2312"},{"type":"WEB","url":"https://github.com/hyperium/hyper/issues/3337"},{"type":"WEB","url":"https://github.com/kazu-yamamoto/http2/issues/93"},{"type":"WEB","url":"https://github.com/junkurihara/rust-rpxy/issues/97"},{"type":"WEB","url":"https://github.com/microsoft/CBL-Mariner/pull/6381"},{"type":"WEB","url":"https://github.com/linkerd/website/pull/1695/commits/4b9c6836471bc8270ab48aae6fd2181bc73fd632"},{"type":"WEB","url":"https://github.com/line/armeria/pull/5232"},{"type":"WEB","url":"https://github.com/kubernetes/kubernetes/pull/121120"},{"type":"WEB","url":"https://github.com/apache/httpd-site/pull/10"},{"type":"WEB","url":"https://github.com/projectcontour/contour/pull/5826"},{"type":"WEB","url":"https://github.com/apache/trafficserver/pull/10564"},{"type":"WEB","url":"https://github.com/nghttp2/nghttp2/pull/1961"},{"type":"WEB","url":"https://github.com/h2o/h2o/pull/3291"},{"type":"WEB","url":"https://github.com/grpc/grpc-go/pull/6703"},{"type":"WEB","url":"https://github.com/nodejs/node/pull/50121"},{"type":"WEB","url":"https://github.com/envoyproxy/envoy/pull/30055"},{"type":"WEB","url":"https://github.com/facebook/proxygen/pull/466"},{"type":"WEB","url":"https://github.com/akka/akka-http/pull/4325"},{"type":"WEB","url":"https://github.com/akka/akka-http/pull/4324"},{"type":"WEB","url":"https://github.com/netty/netty/commit/58f75f665aa81a8cbcf6ffa74820042a285c5e61"},{"type":"WEB","url":"https://github.com/apache/tomcat/commit/944332bb15bd2f3bf76ec2caeb1ff0a58a3bc628"},{"type":"WEB","url":"https://github.com/kazu-yamamoto/http2/commit/f61d41a502bd0f60eb24e1ce14edc7b6df6722a1"},{"type":"WEB","url":"https://lists.w3.org/Archives/Public/ietf-http-wg/2023OctDec/0025.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5"},{"type":"WEB","url":"https://martinthomson.github.io/h2-stream-limits/draft-thomson-httpbis-h2-stream-limits.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZLU6U2R2IC2K64NDPNMV55AUAO65MAF4"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZKQSIKIAT5TJ3WSLU3RDBQ35YX4GY4V3"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZB43REMKRQR62NJEI7I5NQ4FSXNLBKRT"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XFOIBB4YFICHDM7IBOP7PWXW3FX4HLL2"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/X6QXN4ORIVF6XBW4WWFE7VNPVC74S45Y"},{"type":"WEB","url":"https://mailman.nginx.org/pipermail/nginx-devel/2023-October/S36Q5HBXR7CAIMPLLPRSSSYR4PCMWILK.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WLPRQ5TWUQQXYWBJM7ECYDAIL2YVKIUH"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/WE2I52RHNNU42PX6NZ2RBUHSFFJ2LVZX"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ"},{"type":"WEB","url":"https://tomcat.apache.org/security-9.html#Fixed_in_Apache_Tomcat_9.0.81"},{"type":"WEB","url":"https://ubuntu.com/security/CVE-2023-44487"},{"type":"WEB","url":"https://www.bleepingcomputer.com/news/security/new-http-2-rapid-reset-zero-day-attack-breaks-ddos-records"},{"type":"WEB","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-44487"},{"type":"WEB","url":"https://www.cisa.gov/news-events/alerts/2023/10/10/http2-rapid-reset-vulnerability-cve-2023-44487"},{"type":"WEB","url":"https://www.darkreading.com/cloud/internet-wide-zero-day-bug-fuels-largest-ever-ddos-event"},{"type":"WEB","url":"https://www.debian.org/security/2023/dsa-5521"},{"type":"WEB","url":"https://www.debian.org/security/2023/dsa-5522"},{"type":"WEB","url":"https://www.debian.org/security/2023/dsa-5540"},{"type":"WEB","url":"https://www.debian.org/security/2023/dsa-5549"},{"type":"WEB","url":"https://www.debian.org/security/2023/dsa-5558"},{"type":"WEB","url":"https://www.debian.org/security/2023/dsa-5570"},{"type":"WEB","url":"https://www.eclipse.org/lists/jetty-announce/msg00181.html"},{"type":"WEB","url":"https://www.haproxy.com/blog/haproxy-is-not-affected-by-the-http-2-rapid-reset-attack-cve-2023-44487"},{"type":"WEB","url":"https://www.netlify.com/blog/netlify-successfully-mitigates-cve-2023-44487"},{"type":"WEB","url":"https://www.nginx.com/blog/http-2-rapid-reset-attack-impacting-f5-nginx-products"},{"type":"WEB","url":"https://www.openwall.com/lists/oss-security/2023/10/10/6"},{"type":"WEB","url":"https://www.phoronix.com/news/HTTP2-Rapid-Reset-Attack"},{"type":"WEB","url":"https://www.theregister.com/2023/10/10/http2_rapid_reset_zeroday"},{"type":"WEB","url":"https://www.vicarius.io/vsociety/posts/rapid-reset-cve-2023-44487-dos-in-http2-understanding-the-root-cause"},{"type":"WEB","url":"https://msrc.microsoft.com/blog/2023/10/microsoft-response-to-distributed-denial-of-service-ddos-attacks-against-http/2"},{"type":"WEB","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-44487"},{"type":"WEB","url":"https://my.f5.com/manage/s/article/K000137106"},{"type":"WEB","url":"https://netty.io/news/2023/10/10/4-1-100-Final.html"},{"type":"WEB","url":"https://news.ycombinator.com/item?id=37830987"},{"type":"WEB","url":"https://news.ycombinator.com/item?id=37830998"},{"type":"WEB","url":"https://news.ycombinator.com/item?id=37831062"},{"type":"WEB","url":"https://news.ycombinator.com/item?id=37837043"},{"type":"WEB","url":"https://openssf.org/blog/2023/10/10/http-2-rapid-reset-vulnerability-highlights-need-for-rapid-response"},{"type":"WEB","url":"https://seanmonstar.com/post/730794151136935936/hyper-http2-rapid-reset-unaffected"},{"type":"WEB","url":"https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-http2-reset-d8Kf32vZ"},{"type":"WEB","url":"https://security.gentoo.org/glsa/202311-09"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20231016-0001"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240426-0007"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240621-0006"},{"type":"WEB","url":"https://security.netapp.com/advisory/ntap-20240621-0007"},{"type":"WEB","url":"https://security.paloaltonetworks.com/CVE-2023-44487"},{"type":"WEB","url":"https://tomcat.apache.org/security-10.html#Fixed_in_Apache_Tomcat_10.1.14"},{"type":"WEB","url":"https://tomcat.apache.org/security-11.html#Fixed_in_Apache_Tomcat_11.0.0-M12"},{"type":"WEB","url":"https://tomcat.apache.org/security-8.html#Fixed_in_Apache_Tomcat_8.5.94"},{"type":"WEB","url":"https://chaos.social/@icing/111210915918780532"},{"type":"WEB","url":"https://cloud.google.com/blog/products/identity-security/google-cloud-mitigated-largest-ddos-attack-peaking-above-398-million-rps"},{"type":"WEB","url":"https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack"},{"type":"WEB","url":"https://community.traefik.io/t/is-traefik-vulnerable-to-cve-2023-44487/20125"},{"type":"WEB","url":"https://discuss.hashicorp.com/t/hcsec-2023-32-vault-consul-and-boundary-affected-by-http-2-rapid-reset-denial-of-service-vulnerability-cve-2023-44487/59715"},{"type":"WEB","url":"https://edg.io/lp/blog/resets-leaks-ddos-and-the-tale-of-a-hidden-cve"},{"type":"WEB","url":"https://forums.swift.org/t/swift-nio-http2-security-update-cve-2023-44487-http-2-dos/67764"},{"type":"WEB","url":"https://gist.github.com/adulau/7c2bfb8e9cdbe4b35a5e131c66a0c088"},{"type":"WEB","url":"https://github.com/Kong/kong/discussions/11741"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-qppj-fm5r-hxr3"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-vx74-f528-fxqg"},{"type":"ADVISORY","url":"https://github.com/advisories/GHSA-xpw8-rcwv-8f8p"},{"type":"WEB","url":"https://github.com/apache/httpd/blob/afcdbeebbff4b0c50ea26cdd16e178c0d1f24152/modules/http2/h2_mplx.c#L1101-L1113"},{"type":"WEB","url":"https://github.com/apache/tomcat/tree/main/java/org/apache/coyote/http2"},{"type":"PACKAGE","url":"https://github.com/apple/swift-nio-http2"},{"type":"WEB","url":"https://github.com/arkrwn/PoC/tree/main/CVE-2023-44487"},{"type":"WEB","url":"https://github.com/bcdannyboy/CVE-2023-44487"},{"type":"WEB","url":"https://github.com/caddyserver/caddy/releases/tag/v2.7.5"},{"type":"WEB","url":"https://access.redhat.com/security/cve/cve-2023-44487"},{"type":"WEB","url":"https://akka.io/security/akka-http-cve-2023-44487.html"},{"type":"WEB","url":"https://arstechnica.com/security/2023/10/how-ddosers-used-the-http-2-protocol-to-deliver-attacks-of-unprecedented-size"},{"type":"WEB","url":"https://aws.amazon.com/security/security-bulletins/AWS-2023-011"},{"type":"WEB","url":"https://blog.cloudflare.com/technical-breakdown-http2-rapid-reset-ddos-attack"},{"type":"WEB","url":"https://blog.cloudflare.com/zero-day-rapid-reset-http2-record-breaking-ddos-attack"},{"type":"WEB","url":"https://blog.litespeedtech.com/2023/10/11/rapid-reset-http-2-vulnerablilty"},{"type":"WEB","url":"https://blog.qualys.com/vulnerabilities-threat-research/2023/10/10/cve-2023-44487-http-2-rapid-reset-attack"},{"type":"WEB","url":"https://blog.vespa.ai/cve-2023-44487"},{"type":"WEB","url":"https://bugzilla.proxmox.com/show_bug.cgi?id=4988"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242803"},{"type":"WEB","url":"https://bugzilla.suse.com/show_bug.cgi?id=1216123"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-082556.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-341067.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-784301.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-832273.html"},{"type":"WEB","url":"https://cert-portal.siemens.com/productcert/html/ssa-915275.html"},{"type":"WEB","url":"https://cgit.freebsd.org/ports/commit/?id=c64c329c2c1752f46b73e3e6ce9f4329be6629f9"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00047.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00001.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/11/msg00012.html"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2MBEPPC36UBVOZZNAXFHKLFGSLCMN5LI"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3N4NJ7FR4X4FPZUGNTQAPSTVB2HB2Y4A"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/BFQD3KUEMFBHPAPBGLWQC34L4OWL5HAZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CLB4TW7KALB3EEQWNWCN7OUIWWVWWCG2"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/E72T67UPDRXHIDLO3OROR25YAMN4GGW5"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FNA62Q767CFAFHBCDKYNPBMZWB7TWYVU"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HT7T2R4MQKLIF4ODV4BDLPARWFPCJ5CZ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JIZSEFC3YKCGABA2BZW6ZJRMDZJMB7PJ"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JMEXY22BFG5Q64HQCM5CK2Q7KDKVV4TY"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KSEGD2IWKNUO3DWY4KQGUQM5BISRWHQE"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LKYHSZQFDNR7RSA7LHVLLIAQMVYCUGBG"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/LNMZJCDHGLJJLXO4OXWJMTVQRNWOC7UL"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VHUHTSXLXGXS7JYKBXTA3VINUPHTNGVU"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/VSRDIV77HNKUSM7SJC5BKE5JSHLHU2NK"},{"type":"WEB","url":"https://github.com/dotnet/core/blob/e4613450ea0da7fd2fc6b61dfb2c1c1dec1ce9ec/release-notes/6.0/6.0.23/6.0.23.md?plain=1#L73"},{"type":"WEB","url":"https://github.com/grpc/grpc-go/releases"},{"type":"WEB","url":"https://github.com/grpc/grpc/releases/tag/v1.59.2"},{"type":"WEB","url":"https://github.com/icing/mod_h2/blob/0a864782af0a942aa2ad4ed960a6b32cd35bcf0a/mod_http2/README.md?plain=1#L239-L244"},{"type":"WEB","url":"https://github.com/micrictor/http2-rst-stream"},{"type":"WEB","url":"https://github.com/nghttp2/nghttp2/releases/tag/v1.57.0"},{"type":"WEB","url":"https://github.com/oqtane/oqtane.framework/discussions/3367"},{"type":"WEB","url":"https://go.dev/cl/534215"},{"type":"WEB","url":"https://go.dev/cl/534235"},{"type":"WEB","url":"https://go.dev/issue/63417"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo"},{"type":"WEB","url":"https://groups.google.com/g/golang-announce/c/iNNxDTCjZvo/m/UDd7VKQuAAAJ"},{"type":"WEB","url":"https://istio.io/latest/news/security/istio-security-2023-004"},{"type":"WEB","url":"https://linkerd.io/2023/10/12/linkerd-cve-2023-44487"},{"type":"WEB","url":"https://lists.apache.org/thread/5py8h42mxfsn8l1wy6o41xwhsjlsd87q"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00020.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00023.html"},{"type":"WEB","url":"https://lists.debian.org/debian-lts-announce/2023/10/msg00024.html"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/10/10/6"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/10/10/7"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/10/13/4"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/10/13/9"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/10/18/4"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/10/18/8"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/10/19/6"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2023/10/20/8"},{"type":"WEB","url":"http://www.openwall.com/lists/oss-security/2025/08/13/6"}],"database_specific":{"cwe_ids":["CWE-400"],"github_reviewed":true,"github_reviewed_at":"2023-10-10T21:28:24Z","nvd_published_at":"2023-10-10T14:15:10Z","severity":"MODERATE"},"severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:H"},{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:A"}]}